618118 - Crash when uninstalling an add-on with bad bootstrap.js [@ JSCompartment::wrap ]

Status: VERIFIED FIXED

(Core :: XPConnect, defect)

Description

[Ed Lee :Mardak]

Attachment: throw 0 bootstrap.js

If I have a bootstrap.js that does just "throw 0;", uninstalling it then reloading about:addons results in a crash. Interestingly, if I install over the add-on, it doesn't crash (so this is somewhat the opposite of bug 618101).

I've attached an add-on that only has "throw 0;" in bootstrap.js.

Comment 1

[Ed Lee :Mardak]

Oh, forgot to link to the crash reports:

http://crash-stats.mozilla.com/report/index/bp-81a1d0f0-7c15-4bc2-991c-902ba2101209
http://crash-stats.mozilla.com/report/index/bp-165cf36e-cbf9-4b3b-990d-2217d2101209

Comment 2

[Ed Lee :Mardak]

Probably not directly an add-on manager bug, but could probably work around the issue there if necessary.

Might be useful in tracking down the other [@ JSCompartment::wrap ] crashes though? bug 605290 bug 613728 bug 615989

It seems like the uninstall needs to be user triggered. Having the add-on uninstall itself on startup/install doesn't cause the crash.

Comment 3

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

This one is a gimme: need to check ok and not wrap the value if the script execution failed:

http://hg.mozilla.org/mozilla-central/annotate/11e328a49e0a/js/src/xpconnect/loader/mozJSSubScriptLoader.cpp#l407

Comment 4

[timeless]

Attachment: check ok

Comment 5

[Dão Gottwald [:dao]]

http://hg.mozilla.org/mozilla-central/rev/4a05b01c5814

Comment 6

[LegNeato]

As per today's meeting, beta 9 will be a time-based release. Marking these all betaN+. Please move it back to beta9+ if  you believe it MUST be in the next beta (ie: trunk is in an unshippable state without this)

Comment 7

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Edward, I was never able to reproduce this crash. Can you please verify that it is fixed for you? Thanks.